Yeah 99% of the time things will be fine, but if that 1% of the time somebody loses like 500,000$ because nobody warned him. Who's fault will that be?

It'll be yours if they follow your advice and end up in a worse situation, that's why I'm being so adamant about this.

You're not "overblowing" the problems, you're completely mis-stating the threat, the attack surface and the proper solution.

You don't comprehend the threat, it's nature, or it's applicability. You don't seem to understand that this is not an exploitable vulnerability in the general sense. You would have to have downloaded apt from an untrusted source, and then you would have needed to download a compromised package and that package would need to drop malware and get it to run. This isn't likely at all. In fact I'm going to go out on a limb here and say there is a 0% chance this has happened to any one at all, ever since https and app signing were introduced.

Again this isn't windows, we don't just install random crap from random sources via apt. There are other checks in place and you can trust these checks, because lots and lots of people are watching for exactly this sort of shenanigans.

It and your proposed solution leaves the system in an unpatched state where there are known exploits. It doesn't fix it, it makes it worse.

Here is a list of 72 known exploits your "fix" re-introduces.
https://www.ubuntu.com/usn/
You'll notice that the exploit you're concerned about is still on that list. So your solution doesn't fix the problem it just adds 71 more in addition to the heavy work of re-establishing the system configuration after an FFR. Which in the case of some computers requires manually editing config files just to get the internet functional, raid drivers running and don't get me started on 3D graphics.

But if APT is compromized, then the game is over, any malware can reside on your PC. And you cannot trust any hash from that PC, since there exist malwares that could modify it. This is the biggest type of risk there is, when the updater itself could be compromized.

This isn't windows. APT is pulling from https URLs. The URLs are all well known as is their complete contents including the hashes of the files hosted there. There isn't a "broken APT" circulating in the wild. There is no package in any repo that had this bad sig issue. There isn't malware in any of the official repositories. They all pass independent signature verification. Independent, as in a lot of people and systems are checking these things every single time we update our systems. With more than just apt and more than just one hash algo.

So yes I'm going to be a bit dramatic here. You're giving bad advice. I mean it, this is genuine bad advice. You either didn't read the CVE, or you completely misunderstood it. But your advice weakens systems that BTW have very likely already patched against this with no ill effects.